Lucene search

MitreCVE-2020-10173

HistoryMar 05, 2020 - 3:15 p.m.

CVE-2020-10173

2020-03-0515:15:12

CWE-78

mitre

web.nvd.nist.gov

In Wild

comtrend vr-3033

de11-416ssg-c01_r02.a2pvi042j1.d26m

authenticated command injection

ping

traceroute

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.349

Percentile

97.2%

JSON

Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi.

Affected configurations

Nvd

Node

comtrendvr-3033Match-

AND

comtrendvr-3033_firmwareMatchde11-416ssg-c01_r02.a2pvi042j1.d26m

VendorProductVersionCPE
comtrendvr-3033-cpe:2.3:h:comtrend:vr-3033:-:*:*:*:*:*:*:*
comtrendvr-3033_firmwarede11-416ssg-c01_r02.a2pvi042j1.d26mcpe:2.3:o:comtrend:vr-3033_firmware:de11-416ssg-c01_r02.a2pvi042j1.d26m:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
comtrend	vr-3033	-	cpe:2.3:h:comtrend:vr-3033:-:::::::*
comtrend	vr-3033_firmware	de11-416ssg-c01_r02.a2pvi042j1.d26m	cpe:2.3:o:comtrend:vr-3033_firmware:de11-416ssg-c01_r02.a2pvi042j1.d26m:::::::*